CVE-2026-25117

N/A

Descripcion

pwn.college DOJO is an education platform for learning cybersecurity. Prior to commit e33da14449a5abcff507e554f66e2141d6683b0a, missing sandboxing on `/workspace/*` routes allows challenge authors to inject arbitrary javascript which runs on the same origin as `http[:]//dojo[.]website`. This is a sandbox escape leading to arbitrary javascript execution as the dojo's origin. A challenge author can craft a page that executes any dangerous actions that the user could. Version e33da14449a5abcff507e554f66e2141d6683b0a patches the issue.

Detalles CVE

Puntuacion CVSS v3.1N/A

Publicado1/29/2026

Ultima modificacion2/4/2026

Fuentenvd

Avistamientos honeypot0

Debilidades (CWE)

CWE-20CWE-79

Referencias

https://github.com/pwncollege/dojo/commit/e33da14449a5abcff507e554f66e2141d6683b0a(security-advisories@github.com)

https://github.com/pwncollege/dojo/security/advisories/GHSA-wvcf-9xm8-7mrg(security-advisories@github.com)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.